Seeing so many MAPI “Unknown?!” request/response in a packet capture

exchange-2007wireshark

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the mailboxes, in sequence, and do some basic operations.)

We used wireshark to capture the communication going on for several seconds and one thing that stood out is that we see hundreds of lines that read "Protocol: MAPI; Info: Unknown?! request" which is followed by "Protocol: MAPI; Info: Unknown?! response".

We did a capture on another machine (without the application we were testing on the other box) and just opened Outlook. We saw the same behavior.

I'm not familiar with this exchange and it is alarming to me that it is happening so very much.

Can someone point me in the direction of an explanation?

Thanks much!

Best Answer

Can someone point me in the direction of an explanation?

One explanation is that the dissector for MAPI, in your version of Wireshark, might not fully understand MAPI; "Unknown?!" means that a DCE RPC request or response (MAPI is based on Microsoft's RPC mechanism, which is a derivative of DCE RPC) that the protocol dissector doesn't understand was seen.

What version of Wireshark are you using?

Related Solutions

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

You should take a capture on the server to determine if the RST is actually sent by the server or some other intermediate device.

Exchange 2010 Hub cannot deliver to Exchange 2007 Hub – “451 5.7.3 Cannot achieve Exchange Server authentication”

Finally tracked down the cause. Our Cisco ASA firewall was to blame.

From http://jamesosw.wordpress.com/2009/12/30/exchange-hub-transport-unable-to-communicate-at-different-active-directory-sites/:

If you happen to be deploying Exchange 2007/Exchange 2010 Server in a multiple sites environment and using a Cisco ASA Firewall as your VPN tunnel, you’ll likely encounter issues below:

Users are only able to send emails within the same Active Directory site

When users attempt to send an email over to the next hop/Active Directory Site, under the Exchange Queue, you’ll see a Retry status: 451 4.4.0 Primary target IP address responded with “451 5.7.3 Cannot achieve Exchange Server authentication” SMTPRelay to remote AD Site

When you attempt to telnet from the Exchange Servers from both site, you’ll get such response from the telnet command: 220*************

The only way to fix this is to use the Commandline Interface (CLI) and type in this command:
telnet YourCiscoManagementIP

device password (default is usually cisco)

en

password (Management password)

no fixup protocol smtp 25

write mem
Remember to run these command all firewalls at each site. Once is done, telnet to the Exchange server with port 25 and you should get a normal response:
 220 ExchangeServerHostName.Domain.com Microsoft ESMTP MAIL Service ready at Day, Date Month Year, Hour:Minute:Seconds +TimeZone

As soon as we did this on the ASA, mail started flowing without hassles.

Best Answer

Related Solutions

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

Exchange 2010 Hub cannot deliver to Exchange 2007 Hub – “451 5.7.3 Cannot achieve Exchange Server authentication”

Related Topic